tcpdump: disable Capsicum if -E option is provided.

The -E is used to provide a secret for decrypting IPsec.
The secret may be provided through command line or as the file.
The problem is that tcpdump doesn't support yet opening files in capability mode
and the file may contain a list of the files to open.

As a workaround, for now, let's just disable capsicum if the -E
the option is provided.

PR:		236819
MFC after:	2 weeks
This commit is contained in:
Mariusz Zaborski 2019-04-16 04:12:41 +00:00
parent f39ec261ad
commit 42668853c0
Notes: svn2git 2020-12-20 02:59:44 +00:00
svn path=/head/; revision=346263

View File

@ -2063,7 +2063,8 @@ main(int argc, char **argv)
}
#ifdef HAVE_CAPSICUM
cansandbox = (VFileName == NULL && zflag == NULL);
cansandbox = (VFileName == NULL && zflag == NULL &&
ndo->ndo_espsecret == NULL);
#ifdef HAVE_CASPER
cansandbox = (cansandbox && (ndo->ndo_nflag || capdns != NULL));
#else